.NET Tutorials, Forums, Interview Questions And Answers
Welcome :Guest
Sign In
Win Surprise Gifts!!!

Top 5 Contributors of the Month
Gaurav Pal
Post New Web Links

Security Tips: Defend Your Code with Top Ten Security Tips Every Developer Must Know

Posted By:      Posted Date: August 21, 2010    Points: 0   Category :ASP.Net

There are many ways to get into trouble when it comes to security. You can trust all code that runs on your network, give any user access to important files, and never bother to check that code on your machine has not changed. You can run without virus protection software, not build security into your own code, and give too many privileges to too many accounts. You can even use a number of built-in functions carelessly enough to allow break-ins, and you can leave server ports open and unmonitored. Obviously, the list continues to grow. What are some of the really important issues, the biggest mistakes you should watch out for right now so that you don't compromise your data or your system? Security experts Michael Howard and Keith Brown present 10 tips to keep you out of hot water.

Michael Howard and Keith Brown

MSDN Magazine September 2002

View Complete Post

More Related Resource Links

Review It: Expert Tips for Finding Security Defects in Your Code


Reviewing code for security defects is a key ingredient in the software creation process, ranking alongside planning, design, and testing. Here the author reflects over his years of code security reviews to identify patterns and best practices that all developers can follow when tracking down potential security loopholes. The process begins by examining the environment the code runs in, considering the roles of the users who will run it, and studying the history of any security issues the code may have had. After gaining an understanding of these background issues, specific vulnerabilities can be hunted down, including SQL injection attacks, cross-site scripting, and buffer overruns. In addition, certain red flags, such as variable names like "password", "secret," and other obvious but common security blunders, can be searched for and remedied.

Michael Howard

MSDN Magazine November 2003

Security Briefs: Using Protocol Transition-Tips from the Trenches


Now that Windows Server 2003 is widely deployed, Keith Brown addresses questions from readers who are trying to use protocol transition to build secure gateways into their intranets.

Keith Brown

MSDN Magazine January 2007

Administrator and Developer Guide to Code Access Security in SharePoint Server 2007

Explore configuration options, get best practices for managing CAS in SharePoint environments, and walk through a complex CAS scenario.

Tips on using the SQL Server Security forum

I am collecting here a few tips on using this forum. The tips are actually pretty general, they're not really specific to SQL Server or to this particular SQL Server Security forum. 1. Verify that you are posting to the right forum. Check the list from http://forums.microsoft.com/MSDN/default.aspx?SiteID=1 to see whether there is a more appropriate forum for your discussion topic. By posting to the appropriate forum, you will be able to get an answer to your questions faster. 2. Try to avoid crossposting or posting the same issue several times. Do a search to see if your question was already answered. If you receive an answer on another forum, please update or remove your other posts on the same subject. 3. Please mark the posts that answer your questions using the "Mark as Answer" button. This will allow other readers to quickly identify the useful information in a thread. There can be more posts marked as answers in a single thread! 4. If you have posted on this forum but cannot find the post in it anymore, then it might have been moved to another forum. Check using the "My Threads" link: http://forums.microsoft.com/MSDN/User/MyForums.aspx?SiteID=1; it will show all the posts you've made and it will allow you to track a post that was moved to another forum. Also, consider enabling email notifications when a response is made to the threads you initiate. 5

Security tips reqd for website database

I need to provide access to a SQL Server 2008 database to a website for a client. I haven't done this before and I'm looking for tips on security.

The website will be hosted on a server either in a DMZ or external to the network. Access to the SQL server will be through a Cisco router.
The network is a workgroup, not a domain. The website needs write access to one database.

The client wants enough flexibility that I can't restrict them to using stored procedures. It'll be their responsibility to ensure they don't wreck their database.

I'll give them datawriter permissions on that database, and enforce a strict password policy.

What other things should I do to safeguard the SQL server from the evils of the internet?

Wicked Code: 3 Important Tips For Silverlight Development


As a Web platform, Silverlight should be fast. Don't keep your users waiting by not heeding these performance tips.

Jeff Prosise

MSDN Magazine March 2009

Foundations: Adding Code Access Security to WCF, Part 2


This month's column continues the discussion around code access security in WCF and partially trusted services.

Juval Lowy

MSDN Magazine July 2008

Foundations: Code Access Security in WCF, Part 1


Here we discuss code-access security in Windows Communication Foundation (WCF) and present a solution for enabling partially trusted clients for WCF services.

Juval Lowy

MSDN Magazine April 2008

Security Briefs: Protecting Your Code with Visual C++ Defenses


Michael Howard outlines some of the buffer overrun defenses available in Visual C++ 2005 and beyond.

Michael Howard

MSDN Magazine March 2008

Wicked Code: Silverlight Tips, Tricks, and Best Practices


: Jeff Prosise presents great tips for Silverlight development, which while it's gaining wide adoption, still needs more documentation and best practices so developers can make the most of the dazzling new features.

Jeff Prosise

MSDN Magazine Launch 2008

Wicked Code: UpdatePanel Tips and Tricks


Jeff Prosise explains when it's better to use UpdatePanel and when it's better to use asynchronous calls to WebMethods or page methods instead.

Jeff Prosise

MSDN Magazine June 2007

Are You in the Know?: Find Out What's New with Code Access Security in the .NET Framework 2.0


Unlike role-based security measures, code access security is not based on user identity. Instead, it is based on the identity of the code that is running, including information such as where the code came from. Here Mike Downen discusses the role of code access security (CAS) in .NET and outlines some key new features and changes in CAS for the .NET Framework 2.0.

Mike Downen

MSDN Magazine November 2005

Wicked Code: Power Programming Tips for ASP.NET 2.0


In the February 2005 issue, I introduced five lesser-known features of ASP. NET 2. 0 that have the potential to make a significant impact on the security, performance, and robustness of your code (see Wicked Code: Five Undiscovered Features on ASP.

Jeff Prosise

MSDN Magazine June 2005

Security: Manipulate Privileges in Managed Code Reliably, Securely, and Efficiently


When the author was faced with implementing support for changing a security descriptor on an object, he noticed there was not support for that operation in .NET. So he devised two solutions to the problem: the first, simpler one, is tailored to the .NET Framework 1.1 and can be used today. The second solution incorporates several advanced features available only in the .NET Framework 2.0. Both are presented here.

Mark Novak

MSDN Magazine March 2005

Attack Surface: Mitigate Security Risks by Minimizing the Code You Expose to Untrusted Users


In this article, Microsoft security expert Michael Howard discusses the cardinal rules of attack surface reduction. His rules - reduce the amount of code executing by default, reduce the volume of code that is accessible to untrusted users by default, and limit the damage if the code is exploited - are explained along with the techniques to apply the rules to your code.

Michael Howard

MSDN Magazine November 2004

Security Briefs: Beware of Fully Trusted Code


The vast majority of managed applications run with full trust, but based on my experience teaching . NET security to developers with a broad range of experience, most really don't understand the implications of fully trusted code.

Keith Brown

MSDN Magazine April 2004

Return of the Rich Client: Code Access Security and Distribution Features in .NET Enhance Client-Sid


Rich clients employ many of the features and conveniences of the operating system they run on, and the list of these features has been growing since the dawn of the PC. But as apps have migrated to the Web, the trend towards increasing client-side functionality has ground to a virtual halt. There are several reasons for this; chief among them are security and deployment problems. But that's all about to change. With the .NET Framework, you can participate in building the distributable rich client of the future. In this article, the author enumerates the pertinent features of .NET that will allow you to build safe, easily deployable controls. The features discussed include managed code, code access security, versioning control, Windows Forms classes, and isolation.

Jason Clark

MSDN Magazine June 2002

ASP.NetWindows Application  .NET Framework  C#  VB.Net  ADO.Net  
Sql Server  SharePoint  Silverlight  Others  All   

Hall of Fame    Twitter   Terms of Service    Privacy Policy    Contact Us    Archives   Tell A Friend